Brave's built-in strict fingerprinting protection was discontinued in January 2024 because of low adoption and frequent web breakages caused by restricting JavaScript APIs; browser vendors are broadly reluctant to implement robust built-in countermeasures for the same compatibility reason. Spoofing-based extensions (HTTP-header spoofers, Canvas Defender) offer only partial protection and can degrade site functionality through overlapping layouts, unreadable fonts, or bot misclassification.

Fingerprinting acceptance averaged 3.90 for cybersecurity applications, 3.73 for law enforcement, and 3.00 for user experience on a 5-point scale (n=734); privacy-protective behaviors (Privacy Behavior Index, p<0.01) and prior use of Tor or Brave (p<0.01) were the strongest negative predictors of acceptance across all three domains. Privacy concern level (Westin Index) alone did not significantly predict fingerprinting awareness, whereas behavioral privacy practices did.

§4.2.1, §4.2.2 evaluation

Across 734 participants, fingerprinting awareness (mean 2.4 on a 1–4 scale) was significantly lower than cookie awareness (mean 2.86), confirmed by Wilcoxon signed-rank test at p < 0.001. Only 22% of participants had used a privacy-focused browser (Tor or Brave), and the Spearman correlation between cookie and fingerprinting awareness was only ρ = 0.40, indicating that tracking-technology literacy does not transfer automatically between mechanisms.

§4.1.1, Figure 2 evaluation

Among 734 participants, 70.4% were categorized as Privacy Pragmatists willing to trade data for convenience, while only 25.9% were Privacy Fundamentalists; prior use of Tor or Brave (~22% of the sample) and a higher Privacy Behavior Index were the strongest positive predictors of fingerprinting awareness (p<0.01 each), while self-reported privacy concern alone had no significant relationship with awareness. The structural minority of Fundamentalists represents the population disposed to tolerate the usability costs of strong countermeasures.

§4.1.2, §3.3, Figure 10 evaluation

Countermeasures against fingerprinting can paradoxically increase a user's identifiability when deployed by a small population: spoofing-introduced attribute inconsistencies and unusual configurations (e.g., Tor Browser's letterboxing applied to an uncommon monitor size) produce a rarer, higher-entropy fingerprint than baseline. This 'information paradox' means that countermeasure effectiveness is a property of the anonymity set size, not of individual tool configuration.

§2.2 detection

AnyTLS implements a persistent idle-session pool with configurable parameters: idle_session_check_interval (default 30s), idle_session_timeout (default 30s), and min_idle_session (default 5). The client maintains at least 5 pre-established TLS sessions at all times to enable fast connection reuse without a new TLS handshake per request.

2026-anon-anytls-anytls-sing-box-2026 §2.4, §5.3 tls-fingerprinttraffic-shape

Compared to peer protocols, AnyTLS rates 'medium' performance (vs. VLESS 'high', Hysteria2 'very high', TUIC 'high'), uses TCP/TLS transport (vs. UDP/QUIC for Hysteria2 and TUIC), and relies on padding-based obfuscation vs. REALITY/WebSocket (VLESS) or HTTP/3 framing (Hysteria2). Client ecosystem support is currently limited primarily to sing-box, vs. broad cross-client support for VLESS, Trojan, and Hysteria2.

2026-anon-anytls-anytls-sing-box-2026 §1.5, Table 1.5 traffic-shapetls-fingerprint

AnyTLS is a TLS-based proxy protocol maintained by the sing-box team, designed in 2024 and first released in the sing-box dev-next branch. Its core mechanism wraps arbitrary proxy traffic in standard TLS and applies a configurable padding scheme (Padding Scheme) to enhance traffic concealment while maintaining compatibility with standard TLS infrastructure.

2026-anon-anytls-anytls-sing-box-2026 §1.1–1.3 tls-fingerprinttraffic-shapedpi

LetsVPN's exit is described as part of a broader pattern: a wave of 'airport' (proxy subscription service) outages across multiple providers in April 2026, documented in a companion article titled '2026年四月份各大机场断线详解,' indicating coordinated or systematic GFW blocking affecting the circumvention ecosystem broadly during this period.

2026-anon-letsvpn-vpn §协议写死，特征太明显 (reference to companion article) dpitls-fingerprintip-blocking

The blog author, drawing on evaluation experience, concludes that LetsVPN's failure was not caused by IP exhaustion or ordinary node instability but by precise protocol-signature identification: once the GFW extracts a client handshake feature, it can simultaneously block all connections sharing that signature across hundreds of thousands of users.

2026-anon-letsvpn-vpn §公告里的几句大实话 dpitls-fingerprintactive-probing

LetsVPN permanently exited the Chinese mainland market in late April 2026 after its technical team spent 20 days making hourly adjustments and confirmed it could not restore connectivity. The official announcement designated April 8, 2026 as the effective service-termination date and initiated a full refund program.

2026-anon-letsvpn-vpn Official announcement & §Introduction dpitls-fingerprintfully-encrypted-detect